Arnold,
The memory usage has been a concern. I ordered some more memory to bring it up to 512MB (PC100 memory getting harder to find). Here are some links to some sysmon graphs ...
Rest assured (or look at the syslog yourself) your
SME is quite healthy with 256MB
... and more wouldn't have helped ... at least in this case
Here's the entire line from a few messages log denylog entries:
May 3 14:04:36 server kernel: denylog:IN=eth1 OUT= MAC=00:oo:oo:oo:... SRC=68.217.164.157 DST=xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=108 ID=41701 DF PROTO=TCP SPT=2212 DPT=1740 WINDOW=64240 RES=0x00 SYN URGP=0
Let me summarize this for you:
- your outside nic is eth1 with a unique chip-mac info we all know now
- src= is different in each case - see below
- Road Runner is your provider
- some len&id stuff without merit here
- things happened on TCP
- SPT= diffenent for the examples here
- DPT= 1740 ... they all tried to use your TCP Port 1740
... all in vain since this packet was rejected by your kernel.
Look at the list of addresses - all quite different...
=====
68.217.164.157 OrgName: BellSouth.net Inc.
-----
172.186.123.82 OrgName: America Online
-----
69.162.62.81 OrgName: Adelphia Cable Communications
-----
196.36.249.246 OrgName: The Internet Solution, Johannesburg
=====
It seems that some kid is using other peoples machines to DDOS you !!!
My main concern was just preventing future craches. I had noticed that the webserver, mailserver on my server were unavailable starting the same time the swap file usage went through the roof.
It will go through the roof and IMnsHO you can do very little except "turn of your modem"
... and wait till it's "over"...
unplug eth1 if you hear your HD SCREECHING !
Anyway an ideas out there about what you might do next in this situation?
...start looking for a reason "someone likes you"
(if your ip is reasonably stable that is...)
...if you have a variable ip from roadrunner
do what you need to do to get a new ip (modem on/off ?) ... there's ways to do that automatically
if it's always DPT=1740 we could just "drop that without log"
... but in my experience that doesn't really help
(search for drop in this forum).
In any case I doubt it's your hardware and all SME services to the outside will suffer
and to keep at lease internal file server activity stable I'd cut outside ties for a while when such an emergency arises.
! NO NEED TO SHUTDOWN BTW !
Sorry to have you no better
Regards
Reinhold
7 Replies
2046 Views